Directory security

allowing files for authenticated users, redirect for others

[outlaw]

Hello, I have some private files in a directory named "secure" that I am trying to protect using a form login and php sessions.

For authenticated users I have a script that lies in "secure" and crawls thru each subdirectory at the user's request (directory browsing)

So basically... one could get access to a file (secure/sub1/sub2/file.pdf) by being an authenticated user, or guessing the link or by getting the link from an authenticated user.

Is there a way to stop this by allowing authenticated users and redirecting everyone else?

usernames and passwords are stored in a DB

[Lobo]

Check out <snip> maybe worth you while?

[edited by: jdMorgan at 2:47 am (utc) on Feb. 12, 2006]
[edit reason] No software/tool drops, please. See TOS. [/edit]

[outlaw]

I searched for [that software] and it looks like a paid member service. Even if I wasn't broke, I'm assuming this can be easily solved with htacess.

Something like
<files> *.* allow from *.php
deny from everything else
ErrorDocument 403 [blah.com...]

[edited by: jdMorgan at 2:48 am (utc) on Feb. 12, 2006]
[edit reason] No software/tool drops, please. See TOS. [/edit]

[Lobo]

No you have the option to include paid members ..

you can also protect different levels of access and integrate this with your forum membership if necessary..

I realise it cost $139.95 but if that cost outweighs the time / hassle factor of sorting out the code, it's worth considering...

I have used it and it works well..

Also allows you to track users ... ban IP etc ... all the extra options of membership management..

[jdMorgan]

Let's keep this thread non-promotional, please. If you wish to recommend software, please do so via stickymail.

> allow from *.php

You'll need a scripted solution that intergrates with your db, because referrer-based access control is nowhere near as reliable as what you need; Clients (browers and 'bots) do not always send a referrer. It is optional, and many proxies and security software packages block HTTP referrer headers. I can click on a checkbox in my Firefox browser extension toolbar, and stop sending referrers at will. Or, optionally, I can send a spoofed one. Takes 7 seconds to configure...

Jim